Trezor Tells CryptoBilis Customers to Empty Wallets After Implant Claim

By Coinvote

Published October 30, 2026 - 11:22 UTC | 5 mins read

Trezor is advising people who purchased wallets through the reseller CryptoBilis from March onward to transfer their funds, following a report from an Indonesian buyer of a concealed circuit board inside a Safe 5. The company has not yet examined the device, which makes the warning a precaution rather than a confirmed finding.

Trezor warns first and tests later

Trezor said on Friday that it had received a report of a hardware implant inside a Safe 5 bought from reseller CryptoBilis. Decrypt reported that a customer in Indonesia filed the report through Trezor's responsible disclosure program on October 28. The device was bought through the e-commerce platform Tokopedia in August 2026.

The company does not have the device in its lab. It decided to act anyway. Trezor chief commercial officer Danny Sanders told Cointelegraph that the company preferred to alert users immediately instead of waiting for lab confirmation and risking that someone lost money in the interim.

Both The Block and The Defiant carried the same core message in their headlines and summaries. Trezor is urging CryptoBilis buyers to migrate their funds, the Safe 5 at the center of the report has not been inspected by the company, and no CryptoBilis buyer has told it of a loss.

What the reported device is said to do

According to the report as described by Decrypt, the implant is an extra circuit board fitted between the main board and the screen. It carries a cellular module and an antenna. The board is said to capture the content of the display, backup phrase included, and relay it via a cellular connection each time power is connected.

Trezor stressed that it has not verified these details. Its assessment rests on what the buyer described and on a recorded video conversation with that buyer. In its words, what it has seen looks sophisticated enough to justify warning customers immediately.

The mechanism matters because a recovery phrase is the master key to a wallet. As Cointelegraph explained, an attacker holding a stolen phrase can rebuild the wallet elsewhere and transfer the assets out. An implant that copies the phrase from the screen never needs to alter the firmware, so a device could behave normally while leaking its secrets.

The Ledger case that came first

The Trezor warning follows an earlier episode involving a rival. Cointelegraph said that on October 9 accounts emerged of stolen crypto tied to Ledger wallets that CryptoBilis had sold, and that Ledger verified an unauthorized hardware implant inside one of the affected units. A related Cointelegraph link in the same report cited police figures putting losses among Singapore users of tampered Ledger wallets at $2.7 million.

Decrypt added detail on the Ledger side. Ledger's Donjon security team found an implant that picks up the 24-word recovery phrase as it appears on the display while a device is being set up, then transmits it across an LTE connection. Ledger has stated that every confirmed loss traces back to a device purchased via CryptoBilis, and it requested that resellers across seven Asian markets withdraw its products from sale.

In its own blog post, Trezor describes the newly reported implant as seeming to work in a comparable way. The company added that it will not draw comparisons while investigations continue, and that it does not know who is behind the device.

Key figures and dates

The reported timeline is short, and the sources agree on most of its points.

March 2026: the purchase date from which Trezor advises CryptoBilis buyers to move funds.
August 2026: when the affected Safe 5 was bought on Tokopedia.
October 9: Trezor removed CryptoBilis as a reseller, according to Decrypt.
October 13: Trezor announced plans to reduce its reseller network, per Cointelegraph.
October 28: the date the Indonesian customer filed the disclosure.
Four devices: the number of CryptoBilis-bought Trezor units the company had inspected before this report, a Safe 7, two Safe 5s and a Safe 3, with no evidence of tampering found.
More than 60 BTC, about $4.8 million: the loss suffered by one of the largest Ledger-related victims, a scammer, according to Chainalysis as cited by Decrypt.

How the outlets' accounts compare

Decrypt offers the fullest account of the implant's design and the Ledger investigation. It also records Trezor's specific instructions: create a new wallet with a new recovery phrase, never reuse the old phrase on any device, and avoid setting up an unused CryptoBilis device. Affected customers can keep the device and ask Trezor Support for a replacement.

Cointelegraph focuses on Trezor's position and its past statements. A spokesperson described sales through the reseller as "very small" but declined to give figures. The spokesperson also said Trezor has not determined at which point the tampering took place, that it is examining its hardware safeguards, and that seals and packaging alone are not sufficient.

The outlets differ slightly in framing. Decrypt places the removal of CryptoBilis on October 9, while Cointelegraph notes the reseller network reduction plan on October 13 and calls CryptoBilis a former authorized reseller. These are not necessarily in conflict, since one describes a removal and the other a wider plan. The Block and The Defiant, which are covered only by headline and summary, agree on the central points without adding detail.

Why the warning matters to holders and teams

The report challenges a common assumption that a sealed box from an authorized seller is safe. Cointelegraph reported that Trezor said its setup checks were built to catch counterfeit devices and modified firmware. The implant found in the Ledger case read the screen without touching the firmware, so those checks would not necessarily catch it.

Cointelegraph also reported that security researcher Joe Grand told it he warned Trezor in August about altered Trezor One and Model T wallets obtained from unapproved vendors on TikTok and Facebook. Trezor responded that its prior statement about having found no compromised devices covered only new wallets distributed by authorized resellers.

For holders, the practical step is explicit in Trezor's guidance. Anyone who bought from CryptoBilis from March 2026 onward should move funds to a freshly generated wallet. For project teams that hold treasury funds on hardware wallets, the case is a reminder to check where devices were bought and to review whether any came through resellers in the affected region.

Open questions to watch

The first question is whether lab analysis confirms the customer's description once Trezor receives the device. Until then, the report rests on a description and a video interview.

A second question is where in the supply chain the tampering occurred. Trezor has said it has not established that. The company's inspection of four earlier units found nothing, which leaves open whether the issue is limited to a few devices.

Finally, Trezor says no buyer has reported a loss. Whether that holds after the warning spreads, and whether Trezor publishes changes to its hardware protections, will show how serious the exposure turns out to be.

Market snapshot

Asset	Price	24h	7d	Market cap
Bitcoin (BTC)	$77,583	-3.1%	-4.8%	$1.56 trillion

CoinGecko data as of 2026-10-30 (UTC).

FAQ

Who should move funds after the Trezor warning?

Trezor is asking everyone who purchased a wallet from CryptoBilis in March 2026 or later to transfer their funds into a freshly created wallet secured by a new recovery phrase. The old phrase should not be entered on any device, and buyers whose device is still unconfigured are advised against using it.

Has the Trezor implant been confirmed?

No. Trezor said it has not yet received or examined the Safe 5 and has not verified the report. It regards the report as credible because of what the buyer described and a video interview with that person.

Has anyone lost funds from a Trezor bought at CryptoBilis?

Trezor said it has heard from no CryptoBilis buyer who lost money. The confirmed losses cited by Ledger involve its own devices bought from the same reseller.